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DESCRIPTION 

WATERMARK INSERTION APPARATUS AND WATERMARK EXTRACTION 
APPARATUS 

5 

Technical Field 

The present invention relates to a watermark 
insertion apparatus that inserts a watermark in a program 
in order to prevent and suppress illegal use and 
10 distribution of the program, and a watermark extraction 
apparatus . 

Background Art 

With the advance of computer networks , it has become 
15 common for computer programs to be distributed via 

networks . As a computer program can easily be duplicated, 
there is a possibility of illegal secondary distribution 
of program duplicates, and theft of or tampering with 
algorithms in programs. There is thus a need to protect 
20 programs from such illegal use. 

One example of a conventional program protection 
technology is a method whereby an electronic watermark 
is inserted in a program. With this method, a program 
is distributed with different watermark embedded for each 
25 distribution destination. Then, in the event of illegal 
use, watermark is extracted from the illegal user's 
program, and that watermark is analyzed. By this means, 
the source of circulation can easily be detected. 
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An actual watermark insertion method is disclosed, 
for example, in Unexamined Japanese Patent Publication 
No. 2000-76064 (pages 3-4, FIG. 2, PIG. 7). 

With this method, code with no dependency 
5 relationship to the order of execution is first detected. 
Next, a dummy variable operation is inserted in the 
detected part. Then the order of execution of the 
detected part containing the dummy variable operation 
is switched around randomly . 
10 By performing such processing, a mechanism is 

implemented that changes this order of execution as 
electronic watermark for each distribution destination. 

However, a problem with the conventional method of 
inserting an electronic watermark in a program is that 
15 it is easy to alter or delete a watermark based on collusion 
attack . 

"Collusion attack" is an attack method whereby 
watermark data insertion locations are identified by 
finding differences in a plurality of programs in which 
20 watermarks have been inserted. 

When different watermark is inserted in a program 
for each distribution destination, if differences between 
programs distributed to each distribution destination 
are found, only the locations at which watermarks have 
25 been inserted will surface as differences . There is thus 
a problem in that watermark insertion locations can easily 
be identified and watermark can easily be deleted or 
altered . 
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Disclosure of Invention 

It is an object of the present invention to prevent 
easy generation of a program that does not have a watermark 
5 and operates normally, by inserting a watermark in such 
a way that the watermark insertion location cannot be 
identified. 

The present invention generates watermark from ID 
information that uniquely identifies a program 
10 distribution destination, inserts the generated 

watermark in a program, and prevents the program from 
operating correctly if the watermark is tampered with, 
and also inserts the same watermark verification code 
to examine whether the watermark is tampered with in a 
15 program regardless of the distribution destination. 

By this means, it is possible to prevent detection 
of watermark verification code constituting a watermark 
by means of collusion attack. As a result, a distribution 
destination cannot generate a program that does not have 
20 a watermark and operates normally, and thus is not able 
to circulate a program illegally. 



Brief Description of Drawings 

FIG.l is a configuration diagram of an illegal 
25 distribution prevention system implemented by means of 
watermark insertion according to Embodiment 1 of the 
present invention; 

FIG. 2 is a configuration diagram of a watermark 
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insertion apparatus according to Embodiment 1; 

FIG. 3 is a configuration diagram of a watermark 
extraction apparatus according to Embodiment 1; 

FIG. 4 is a flowchart showing the operation of a 
5 watermark insertion section according to Embodiment 1; 

FIG. 5 is a drawing showing program code generated 
when Embodiment 1 is applied; 

FIG. 6 is a flowchart showing the operation of a 
watermark detection section of Embodiment 1; 
10 FIG. 7 is a flowchart showing the operation of a 

watermark insertion section according to Embodiment 2 
of the present invention; 

FIG. 8 is a drawing showing program code generated 
by a watermark insertion section according to Embodiment 
15 2; 

FIG. 9 is a flowchart showing the operation of a 
watermark insertion section according to Embodiment 3 
of the present invention; 

FIG. 10 is a drawing showing program code generated 
20 by a watermark insertion section according to Embodiment 
3; 

FIG. 11 is a configuration diagram of an illegal 
distribution prevention system implemented by means of 
watermark insertion according to Embodiment 4 of the 
25 present invention; 

FIG. 12 is a configuration diagram of a watermark 
insertion apparatus in Embodiment 5 of the present 
invention; 
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FIG. 13 is a flowchart showing the operation of a 
dummy code insertion section and watermark insertion 
section in Embodiment 5; 

FIG. 14 is an example of program code generated by 
5 a watermark insertion section in Embodiment 5; 

FIG. 15 is a flowchart of the operation of a watermark 
detection section in Embodiment 5; 

FIG. 16 is a flowchart of the operation of a watermark 
insertion section of Embodiment 6 of the present 
10 invention; and 

FIG. 17 is a drawing showing program code generated 
by a watermark insertion section according to Embodiment 
6. 



15 Best Mode for Carrying out the Invention 
( Embodiment 1 ) 

An illegal program distribution prevention system 
comprising a watermark insertion apparatus and watermark 
extraction apparatus according to Embodiment 1 of the 
20 present invention will now be explained with reference 
to the accompanying drawings . 

FIG.l is a configuration diagram of an illegal 
distribution prevention system implemented by means of 
watermark insertion according to Embodiment 1. 
25 First, at the time of program distribution , the 

distribution source 10 performs distribution with a 
different watermark inserted by means of a watermark 
insertion apparatus 20 for each of distribution 



V 
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destinations 40a and 40b (it is assumed that secondary 
distribution by distribution destinations is not 
authorized) . 

By performing distribution with watermarks embedded 
5 in this way , in the event of program c irculation via illegal 
secondary distribution, for example, distribution source 
10 can confirm the distribution destination by extracting , 
by means of a watermark extraction apparatus 30 , the 
watermark from the program circulated to the circulation 
10 destination 50 , and identify circulation source 
(distribution destination) 40a or 40b. 

Furthermore, distribution destinations 40a and 40b 
will fear identification as the circulation source, and 
will refrain from illegal secondary distribution. 
15 m this way, the illegal distribution prevention 

system suppresses illegal distribution by means of 
watermarks. 

Next, watermark insertion apparatus 20 according 
to Embodiment 1 will be described using FIG. 2. FIG. 2 is 
20 a configuration diagram of a watermark insertion 
apparatus according to Embodiment 1 . 

Watermark insertion apparatus 20 is provided with 
a program input section 201. Program input section 201 
is a means of inputting program code that inputs a watermark . 
25 Program input section 201 outputs program code to a 
watermark insertion section 202. 

Watermark insertion section 202 is a means of 
generating a watermark to be actually embedded in a program 



WO 2004/038531 




PCT/JP2003/013405 



7 

from ID information generated by an ID information 
generation section 205 , and inputting the watermark to 
program code output from program input section 201. If 
the program code output by program input section 201 is 
5 source code, watermark insertion section 202 compiles 
the source code and passes the watermark input location 
to a watermark information storage section 206 as an 
assembler code line number. 

A program output section 203 is a means whereby 
10 watermark insertion section 202 outputs input program 
code . 

A watermark data input section 204 inputs watermark 
data. The input watermark data is information that 
uniquely specifies a distribution destination, 
15 comprising the distribution destination address, 

telephone number, company, e-mail address, and so on. 
Distribution source information may also be input in the 
watermark data . 

ID information generation section 205 generates ID 
20 information that can be uniquely determined from 

watermark data input by watermark data input section 2 04 . 
ID information may be the input data itself, or may be 
data obtained by encryption of the input data. Also, ID 
information may be an ID for uniquely specifying watermark 
25 data in a database holding watermark data. 

In embodiments of the present invention, a mode is 
used whereby watermark is generated based on ID 
information, but it is not absolutely necessary for 
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watermark to be generated based on ID information, and 
it is sufficient to be able to specify a distribution 
destination uniquely from watermark . For example , it is 
also acceptable to enable a distribution destination to 
5 be uniquely specified by inserting a sequence number 1 
to N in software as watermark, distributing sequence 
number i software to distribution destination A, 
distributing sequence number j software to distribution 
destination B, and so forth. 
10 Watermark information storage section 206 is a means 

of storing an insertion location of a watermark inserted 
by watermark insertion section 202. Specifically, the 
assembly code line number of the code in which a watermark 
is inserted is stored. 
15 Next, watermark extraction apparatus 30 according 

to Embodiment 1 will be described using FIG. 3. FIG. 3 is 
a configuration diagramof watermark extraction apparatus 
30 according to Embodiment 1. 

Program input section 301 is a means of inputting 
20 a program in which a watermark is input. 

A watermark detection section 302 disassembles a 
program output from program input section 301, and 
extracts an input watermark from the watermark insertion 
location (assembler code line number) obtained from a 
25 watermark information storage section 305. Watermark 
detection section 302 then generates ID information from 
the extracted watermark, and passes this ID information 
to an ID information storage section 304. 
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ID information storage section 304 is a means of 
generating distribution destination information from ID 
information obtained from watermark detection section 
302. When ID information is a database data ID, ID 
5 information storage section 304 obtains distribution 
destination information by extracting data from the ID. 
When ID information is distribution destination 
information encryption data, ID information storage 
section 304 obtains distribution destination information 
10 by performing decryption. 

Watermark information storage section 305 is a means 
of storing a watermark insertion location of a distributed 
program. Watermark insertion location information is 
obtained from watermark information storage section 2 06 
15 of watermark insertion apparatus 20. 

Output section 303 is a means of outputting obtained 
distribution destination information. 

Next, watermark insertion section 2 02 according to 
Embodiment 1 will be described using FIG. 4. FIG. 4 is a 
20 flowchart showing the operation of watermark insertion 
section 202 according to Embodiment 1. 

First, watermark insertion section 202 generates, 
by means of generation function F(l), watermark Xl and 
X2 to be actually inserted into the program from ID 
25 information I generated from distribution destination 
40 information (step 401). 

Next, watermark insertion section 202 configures 
function F21 that outputs constant Cl and function F22 
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that outputs constant C2 when watermark XI and X2 is used 
as input (step 402). 

Watermark insertion section 202 then embeds in the 
program code an expression that assigns watermark XI and 
5 X2 to variables vail and val2 (step 403). 

Watermark insertion section 202 then embeds in the 
program code an expression that assigns F21 ( vail , val2 ) 
to variable val3, and F22 ( vail , val2 ) to variable val4 
( step 404 ) . 

10 Next / watermark insertion section 202 embeds in the 

program code as watermark verification code a conditional 
branch that determines whether variable val3 and constant 
CI are equal and halts the program if they are not equal, 
and a conditional branch that determines whether variable 
15 val4 and constant C2 are equal and halts the program if 
they are not equal (step 405). 

Watermark insertion section 202 then stores the 
locations at which watermark and watermark verification 
code were inserted in step 403 through step 405 in watermark 
20 information storage section 206 (step 406). 

In this way , watermark insertion section 2 02 inserts 
in the program watermark and watermark verification code . 

Watermark insertion section 202 inputs the 
expressions and conditional branches (watermark 
25 verification code) inserted in step 403 through step 405 
in the order of execution of the program. A condition 
for Fl is that there should be an inverse function of 
Fl that generates I uniquely from XI and X2 , and a condition 
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for F21 and F22 is that F2 1 ( Xl , X2 ) ==C1 and F22 ( XI , X2 ) ==C2 
should not hold other than for XI and X2 ("==" indicates 
that the values are equal). 

For example, a case will be considered in which ID 
5 information = 12345678, Fl is a function that divides 
an 8-digit value into two values from the 4th digit, 
F21(x,y) and F22(x,y) are 2-variable linear functions 
ax+by, CI = 2345, and C2 = 5678. 

In this case, watermark Xl = 1234 and X2 = 5678 is 
10 first generated from Fl. F21 and F22 are configured by 
finding al, a2, bl, and b2 that satisfy the conditions 
al x 1234 + bl x 5678 = 2345 and a2 x 1234 + b2 x 5678 
= 5678. For example, values of al = 1, a2 = 0.195667, 
a2 = 3.700972, and b2 = 0.195667 satisfy the conditions. 
15 An example of program code generated when Embodiment 

1 is applied is shown in FIG. 5. 

In FIG. 5, 500a is a basic program forming the basis 
input by program input section 201. Programs 500b and 
500c are watermark insertion programs in which watermark 
20 and watermark verification code have been input in basic 
program 500a. 

First, in step 403, watermark insertion section 202 
inputs watermark Xla (1234), Xlb (5678) and X2a (1111), 
X2b (2222) generated from different ID information la 
25 (12345678) and lb (11112222) into programs 500b and 500c 
(part indicated by reference numeral 501 in the drawing) . 

Next, in step 404, watermark insertion section 202 
inserts mutually differing F21 and F22 respectively into 
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watermark insertion programs 5 0 0b and 5 00c ( part 
indicated by reference numeral 502 in the drawing) . 

Then, in step 405, watermark insertion section 202 
embeds in the program code, as watermark verification 
5 code, a conditional branch that determines whether 

variable val3 and constant CI (2345) are equal and halts 
the program if they are not equal (assert(O)), and a 
conditional branch that determines whether variable val4 
and constant C2 (5678) are equal and halts the program 
10 if they are not equal (assert(O)) (part indicated by 
reference numeral 503 in the drawing). 

The point to be noted here is that, when the 
differences between the two programs 500b and 500c are 
identified, parts 501 and 502 constituting watermark are 
15 detected, but conditional branches 503 constituting 
watermark verification code are not detected. 
Consequently, even if a watermark input location is 
detected by means of collusion attack on programs 500b 
and 500c , and alteration or deletion of the detected part 
20 is carried out, alteration or deletion cannot be performed 
on the conditional branches 503 constituting watermark 
verification code. Therefore, the watermark 
verification code part 503 does not meet the conditions, 
and the program no longer operates. 
25 Thus, in the case of a simple method of altering 

or deleting only a location detected by means of collusion 
attack, it is possible to prevent acquisition of a program 
that operates normally when all watermarks are deleted. 
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For the sake of clarity , source code is used in FIG. 5 , 
but the same applies when binary code is used. Also, in 
the case of conditional branches 503 , processing is 
performed so that the program is halted if the conditional 
5 statement is true, but it is also possible to perform 
processing that changes variable values in the program 
(using a++, for example) so that the program operates 
abnormally instead of halting. 

Also, in Embodiment 1, two items of watermark are 
10 generated from ID information, but it is also possible 
to generate three or more items of watermark. 

Next, watermark detection section 302 according to 
Embodiment 1 will be described using FIG. 6. FIG. 6 is a 
flowchart showing the operation of watermark detection 
15 section 302 of Embodiment 1. 

First, watermark detection section 302 disassembles 
program execution code (step 1001). 

Next, watermark detection section 302 refers to 
watermark information storage section 305 , obtains stored 
20 information in which the watermark insertion location 
in the program is stored (that is , a line number indicating 
the insertion location), and based on this, specifies 
the input location of watermark XI and X2 . Watermark 
detection section 302 then extracts watermark Xl and X2 
25 from the program (step 1002). 

Next, watermark detection section 302 generates ID 
information using the inverse function of function Fl 
used when generating watermark XI and X2 (step 1003). 
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In this way, watermark detection section 302 obtains 
ID information and performs specification of distribution 
destination 40. 

With the above method, if the code execution order 
5 is switched around by means of optimization or 

''obfuscating" (that makes reading more difficult) by an 
execution code distribution destination or circulation 
destination , it is possible that the assembler line number 
of a watermark input location will be changed , preventing 
10 acquisition of the watermark. In consideration of such 
a possibility, the processing in step 1002 may be changed 
to processing whereby an assignment instruction is sought 
in lines around the assembler line number indicating the 
insertion location, and the operand part of the assignment 
15 instruction is extracted. 

As described above, according to Embodiment 1, 
watermark verification code (part 503 in FIG. 5) is the 
same regardless of the distribution destination, and 
therefore it is possible to prevent watermark 
20 verification code (part 503 in FIG. 5) from being detected 
as a difference by means of collusion attack. 
Consequently, the insertion location of watermark 
verification code cannot be detected by collusion attack. 
As a result, in the case of a simple method of altering 
25 or deleting only a location detected by means of collusion 
attack, alteration or deletion of all watermarks cannot 
be performed, and it is not possible to generate a program 
without a watermark (or with an altered watermark) that 
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operates normally. Thus, a distribution destination 
cannot generate a program that has no watermark and 
operates normally, and therefore cannot circulate a 
program illegally . 
5 A mode is also possible in which the processing 

performed by watermark insertion apparatus 20 and 
watermark extraction apparatus 30 is in the form of a 
program and is executed by a general-purpose computer. 

10 (Embodiment 2) 

Embodiment 2 provides for a case where a person 
intending to distribute a program illegally attempts to 
alter or delete watermark verification code of Embodiment 
1 by detecting watermark by means of collusion attack, 
15 detecting a location at which a variable generated by 
a function used in the detected watermark is used (part 
indicated by reference numeral 503 in FIG • 5 ) , and altering 
or deleting the detected location. 

Specifically, watermark is used, and watermark 
20 verification code necessary to operate a program normally 
is inserted in the program. 

By this means it is possible to prevent a program 
from being operated normally when watermark verification 
code using watermark is detected and altered or deleted 
25 by means of the above-described procedure. 

Embodiment 2 is described in detail below. The 
difference between the watermark insertion apparatus in 
Embodiment 2 and watermark insertion apparatus 20 in 
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Embodiment 1 lies in the operation of watermark insertion 
section 202. 

Next, the operation of the watermark insertion 
section of Embodiment 2 will be described using FIG. 7. 
5 FIG. 7 is a flowchart showing the operation of the watermark 
insertion section of Embodiment 2. 

The operations in step 601 and step 602 are the same 
as the operations in step 401 and step 402 described in 
Embodiment 1, and therefore descriptions thereof are 
10 omitted here. 

Next, the watermark insertion section generates 
function F3 that generates C3 so that CI + C2 + C3 = 0 
from watermark XI and X2 (step 6 03). 

The watermark insertion section then embeds in the 
15 program code an expression that assigns watermark XI and 
X2 to variables vail and val2 (step 604). 

The watermark insertion section then embeds in the 
program code an expression that assigns F2 1 ( vail , val2 ) 
to variable val3, and F22 ( vail , val2 ) to variable val4 
20 (step 605) . 

Next, the watermark insertion section embeds in the 
program code as watermark verification code a conditional 
branch that determines whether variable val3 and constant 
CI are equal and halts the program if they are not equal, 
25 and a conditional branch that determines whether variable 
val4 and constant C2 are equal and halts the program if 
they are not equal (step 606). 

The watermark insertion section then embeds an 
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expression that assigns F3 ( vail , val2 ) to variable val5 
( step 607 ) . 

Then the watermark insertion section inserts in the 
program, as watermark verification code, code that adds 
5 val3 + val4 + val5 to a decision statement that determines 
original code 0 (step 608). 

Watermark insertion section 202 then stores the 
locations at which watermark and watermark verification 
code were inserted in step 604 through step 608 in watermark 
10 information storage section 206 (step 609). 

in this way, watermark insertion section 2 02 inserts 
a watermark in the program. 

The points to be noted here are that variables val3, 
val4, and val5 detected by collusion attack are included 
15 in val3 + val4 + val5 inserted in step 608, and that val3 
+ val4 + val5 is inserted in the 0 part of the decision 
statement related to program operation. As a result, if 
an illegal user attempts to detect variables (val3, val4, 
val5) by means of collusion attack, and alter or delete 
20 a location using variables generated by a function using 
the detected variables, a decision statement related to 
program operation will also be altered or deleted . Thus , 
the program will not operate normally, and cannot be used 
illegally. 

25 Next, program code generated by a watermark 

insertion section according to Embodiment 2 will be 
described using FIG. 8. 

In FIG. 8, 800a is a basic program forming the basis 
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input by program input section 20 1, and program 8 00b is 
a watermark insertion program in which a watermark has 
been input in basic program 800a. 

In program 800b, watermark is inserted in the part 
5 indicated by reference numeral 701 in step 604 f and 
calculation expressions (code) for watermark 
verification are inserted in the part indicated by 
reference numeral 702, 

Then, in program 800b, the processing result of step 
10 608 is inserted in the part indicated by reference numeral 

703 . Also, in program 800b, watermark verification code 
is inserted in the part indicated by reference numeral 

704 in step 606. 

The result of generating program 800b in this way 
15 is that, if a person attempting illegal use detects 

watermark verification code 703 from program 800b by means 
of collusion attack and alters or deletes the watermark 
verification code, since watermark verification code 703 
is code related to the specifications (related to program 
20 input/output in the original code) , the program will not 
operate normally if this code is deleted. 

In order to change only the watermark verification 
code 7 03 decision statement within the watermark, it is 
necessary to understand the program specifications and 
25 know that watermark verification code 703 is 

specification related code. It takes time to understand 
the structure of a program, and watermark deletion cannot 
be performed by means of mechanical processing. 
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The condition Cl + C2 + F3 = 0 need not apply. In 
this case, Cl + C2 + F3 can be inserted in a decision 
statement that uses the value obtained from Cl + C2 + 
F3. For example, if Cl + C2 + F3 = 1, 1 of a decision 
5 statement determining 1 is switched with Cl + C2 + F3 . 

As described above, according to Embodiment 2, if 
a location (part 7 03 shown in FIG. 8) at which variables 
generated by functions used in watermark (701, 702) 
detected by means of collusion attack are used is detected 
10 and altered or deleted, it becomes impossible for the 
program to operate normally. That is to say, it can be 
made impossible to generate a program without a watermark 
(or with an altered watermark) that operates normally, 
thereby enabling illegal program distribution to be 
15 prevented. 



( Embodiment 3 ) 

Embodiment 3 alters code around a location at which 
watermark and watermark verification code are input, or 

20 all code, by performing processing such as "obfuscating . " 
Consequently, code other than a watermark is detected 
by collusion attack, thus enabling watermark alteration 
or deletion based on collusion attack to be prevented 
with certainty. 

25 Embodiment 3 is described in detail below. The 

difference between the watermark insertion apparatus in 
Embodiment 3 and watermark insertion apparatus 20 in 
Embodiment 1 lies in the operation of watermark insertion 
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section 202 . 

Next, the operation of watermark insertion section 
202 of Embodiment 3 will be described using FIG. 9 . FIG. 9 
is a flowchart showing the operation of watermark 
5 insertion section 202 of Embodiment 3. 

First, watermark insertion section 202 assigns an 
initial value of 1 to variable i (step 800). Then the 
watermark insertion section divides ID information into 
n items of information, and generates watermark X(l) f 
10 X(2) ..• (X)n (step 801). 

Next, watermark insertion section 2 02 detects a loop 
section (while, for statements) in the program source 
code (step 802), and inserts watermark X(i) within the 
loop (step 803) . 
15 Watermark insertion section 202 then "obfuscates" 

the insertion location loop section by applying the method 
described in "Method for Scrambling Programs Containing 
Loops" (Monden et al., Technical Report of IEICE D-I, 
Vol. J80-D-I, No. 7, pp. 644-652, July 1997) (step 804). 
20 At this time, there are a number of variations in the 
program obfuscating method , and the variation is selected 
at random (or so as not to duplicate obfuscating executed 
on a program distributed in the past) . 

Then, watermark insertion section 202 determines 
25 whether variable i is less than or equal to the number 
of items of watermark n (step 805), and if variable i 
is less than or equal to n, increments variable i (step 
806) and proceeds to the processing in step 802. If, on 
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the other hand, variable i is determined not to be less 
than or equal to n in step 805 — that is, if all watermark 
has been input — watermark insertion section 2 02 next 
compiles the source code, stores the assembler code line 
5 numbers at which watermark was input, outputs the program, 
and terminates processing (step 807). 

Next , program code generated by watermark insertion 
section 202 according to Embodiment 3 will be described 
using FIG. 10 . In FIG • 10, 9 0 0a is a basic program forming 
10 the basis input by program input section 201. Programs 
900b and 900c are watermark insertion programs in which 
watermark 901 has been input in basic program 900a. 

In programs 900b and 900c, implementation differs 
according to obfuscating, but the specifications 
15 (relationship to program input/output) are not changed. 
When the differences between programs 9 00b and 900c are 
identified, since program code has also been modified 
at locations other than the watermark location, 
non-watermark parts 902a and 902b are also detected as 
20 differences. 

Therefore , in order to alter or delete the watermarks 
of programs 900b and 900c, it is necessary to analyze 
the programs and find out which parts are watermarks 
unrelated to the program specifications. Since 
25 determining whether a part is unrelated to the program 
specifications requires an understanding of the program 
specifications, it is difficult to mechanically delete 
a watermark embedded using this method. 
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As described above, according to Embodiment 3, the 
watermark insertion section also operates as an 
alteration means that performs obfuscating processing 
so that program specifications are not affected in parts 
5 other than a location at which a program watermark is 
inserted, so that non-watermark code in parts related 
to program specifications is detected by collusion attack . 
It is thus difficult to identify a watermark insertion 
location based on collusion attack. As a result, it is 
10 possible to prevent watermark alteration or deletion with 
certainty, and to prevent illegal program circulation. 

(Embodiment 4) 

In Embodiment 4, a watermark insertion apparatus 
15 is provided at a distribution destination, and a watermark 
is given to a distributed program at the distribution 
destination . 

The configuration of an illegal distribution 
prevention system according to Embodiment 4 is described 
20 below using FIG. 11. FIG. 11 is a configuration diagram 
of an illegal distribution prevention system implemented 
by means of watermark insertion according to Embodiment 
4. Parts identical to parts already described are 
assigned the same codes as the corresponding previously 
25 described parts. 

In this system, distribution source 1100 first 
distributes to distribution destinations 1110 and 1120 
respectively ID information 1101 and ID information 1102 
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that uniquely determine distribution destinations 1110 
and 1120 respectively. 

In response to this, distribution destinations 1110 
and 1120 store ID information 1101 and 1102 in watermark 
5 insertion apparatuses 20a and 20b. 

Next, distribution source 1100 distributes a 
program 1103 to distribution destinations 1110 and 1120. 

In response to this, distribution destinations 1110 
and 1120 generate programs 1111 and 1121 in which 
10 watermarks are inserted in distributed program 1103 using 
watermark insertion apparatuses 20a and 20b. 

Watermark insertion apparatuses 20a and 20b may be 
watermark insertion apparatuses according to any one of 
Embodiment 1 through Embodiment 3 . 
15 Thereafter, insertion apparatuses 20a and 20b 

transmit storage information 1104 and 1105 to 
distribution source 1100, and distribution source 1100 
holds storage information 1104 and 1105. 

If distribution destination 1110 performs illegal 
20 secondary distribution to circulation destination 1130 , 
distribution source 1100 obtains the circulated program 
1112, and inputs it together with storage information 
1104 and 1105 to watermark extraction apparatus 30. 
Distribution source 1100 then acquires ID information 
25 1107 specifying distribution destination 1110 or 1120 
by means of watermark extraction apparatus 30. 
Distribution source 1100 next compares ID information 
1101 and 1102 distributed to distribution destinations 
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1110 and 1120 with acquired ID information 1107, and 
identifies distribution destination 1110 or 1120 that 
illegally circulated the program. 

As described above, according to Embodiment 4, it 
5 is possible to easily distribute a program to an 

unspecified number of distribution destinations, and 
insert watermarks at distribution destinations. This 
kind of mode is effective when applied to a system in 
which it is desirable to simply distribute programs only, 
10 such as program distribution using digital broadcasting, 
multicasting or broadcasting via an IP network, and so 
forth. 

( Embodiment 5 ) 

15 Embodiment 5 alters a program by adding dummy code 

that does not affect program specifications at a location 
at which a watermark insertion method or other method 
is implemented. As a result, code other than a watermark 
is detected at different locations when collusion attack 

20 is executed, thus enabling watermark alteration or 

deletion based on collusion attack to be prevented with 
certainty . 

Next , ^a watermark insertion apparatus 1200 
according to Embodiment 5 will be described using FIG . 12 . 
25 FIG. 12 is a configuration diagram of a watermark insertion 
apparatus of Embodiment 5. 

The operation of program input section 201 of 
watermark insertion apparatus 1200 according to 
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Embodiment 5 is identical to that of program input section 
201 of watermark insertion apparatus 20 in other 
embodiments . 

Watermark insertion apparatus 12 00 is provided with 
5 a dummy method input section 12 03 that inputs a redundant 
dummy method that does not affect execution of a program 
output by program input section 201 . Dummy method input 
section 1203 outputs an input dummy method to a dummy 
method insertion section 1201. 
10 Dummy method insertion section 1201 is a means of 

adding a dummy method input by dummy method input section 
12 03 as an area for embedding a watermark. Dummy method 
insertion section 1201 outputs a program to which a dummy 
method has been added to a dummy code insertion section 
15 1202. 

Dummy code insertion section 1202 is an alteration 
means of performing alteration without changing program 
specifications by inserting a dummy code pair not 
necessary for program execution results at locations at 
20 which all program methods ( all methods including the dummy 
method) are implemented without affecting program 
execution. An example of dummy code that could be 
inserted is the PUSH/POP pair. 

Watermark insertion section 202, program output 
25 section 203, watermark data input section 204, and ID 
information generation section 205 are means identical, 
respectively, to watermark insertion section 202 , program 
output section 203, watermark data input section 204, 
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and ID information generation section 205 of watermark 
insertion apparatus 2 0 in other embodiments. 

Watermark information storage section 1204 stores 
information on the correspondence between characters, 
5 numeric values, and symbols used in watermarks and bit 
strings, and information on the correspondence between 
bit strings and instruction codes, for watermarks 
inserted by watermark insertion section 202. Watermark 

10 and line number as identification information for a dummy 
method used for watermark insertion. Moreover, when 
encrypted data is used as watermark data, watermark 
information storage section 1204 also stores key 
information for decryption of the data. 
15 in this way, a watermark insertion location can 

easily be identified using identification information, 
and watermark can easily be detected. 

Next, a watermark extraction apparatus 30 according 
to Embodiment 5 will be described . The difference between 
20 watermark extraction apparatus 30 according to Embodiment 
5 and watermark extraction apparatus 30 in other 
embodiments lies in the operation of watermark 
information storage section 305. 

Watermark detection section 302 acquires 
25 identification information of a method used for watermark 
insertion obtained from watermark information storage 
section 305 in a program output from program input section 
301, and checks themethod indicated by the identification 
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information . 

Next, watermark detection section 302 extracts 
watermark inserted in the program by performing 
conversion from instruction code to bit string , and from 
5 bit string to character, numeric value, or symbol, using 
the correspondence between characters, numeric values, 
and symbols used in watermarks and bit strings, and the 
correspondence between bit strings and instruction codes , 
obtained from the same watermark information storage 

10 section 305 • 

Watermark detection section 302 generates ID 
information from an extracted watermark, and outputs it 
to ID information storage section 304. 

Watermark information storage section 305 is a means 
15 of holding identification information of a method in which 
a watermark is inserted. Watermark information storage 
section 305 also stores the correspondence between 
characters, numeric values, and symbols used in a 
watermark of a distributed program and bit strings, and 
20 the correspondence between bit strings and instruction 
codes. Moreover, when inserted watermark is encrypted, 
watermark information storage section 305 also holds the 
key for decryption of the data. Watermark information 
storage section 305 obtains the correspondence between 
25 characters, numeric values, and symbols and bit strings, 
the correspondence between bit strings and instruction 
codes, identification information for a method in which 
a watermark is inserted, and a key for decryption of 
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encrypted data, from watermark information storage 
section 1204 . 

Next, the operation of dummy code insertion section 
1202 and watermark insertion section 202 of Embodiment 
5 5 will be described using FIG .13. FIG. 13 is a flowchart 
showing the operation of dummy code insertion section 
1202 and watermark insertion section 202 of Embodiment 
5. 

First, dummy code insertion section 1202 assigns 
10 an initial value of 1 to variable i (step 1300). Then 
watermark insertion section 202 generates watermark S 
from ID information, using the correspondence between 
characters, numeric values, and symbols and bit strings 
(step 1301) . 

15 Dummy code insertion section 1202 then detects a 

method section ( location at which a method is implemented) 
in the program ( step 1302 ) and determines whether variable 
i is less than or equal to the total number of methods 
in the program (step 1303), and if variable i is less 
20 than or equal to the total number of methods, inserts 
essentially unnecessary dummy code that does not affect 
the program specifications (step 1304). 

There are a number of variations of the dummy code 
inserted at this time, and the variation is selected at 
25 random, or so as not to duplicate dummy code inserted 
in a program distributed in the past. That is to say, 
dummy code is inserted in such a way that the dummy code 
will be extracted by collusion attack. 
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Next, watermark insertion section 202 determines 
whether the detected method section is a dummy method 
(step 1305) , and if it is a dummy method, inserts watermark 
S by applying the method described in "A Watermarking 
5 Method for Computer Program" (Monden et al., 1998 

Symposium on Cryptography and Information Security , 
SCIS '98-9. 2. A, Jan. 1998) (step 1306). 

At this time, watermark insertion section 202 also 
retains dummy method identification information (step 
10 1307). 

Watermark insertion section 202 then increments 
variable i (step 1308) and proceeds to the processing 
in step 1302. 

If , on the other hand, variable i is determined not 
15 to be less than or equal to the total number of methods 
in step 1303 — that is, if dummy code has been inserted 
in all methods, and watermark has been inserted in a dummy 
method thereamong — watermark insertion section 202 
outputs a program in which watermark has been embedded 
20 (step 1309) . 

With a program generated by watermark insertion 
section 202 according to Embodiment 5, implementation 
differs according to dummy code insertion, but the 
specifications (relationship to program input/output) 
25 are not changed. Also, since different dummy codes are 
inserted by the respective programs, when differences 
between programs are identified in order to identify a 
watermark insertion method f methods other than a method 
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in which a watermark is inserted are also detected as 
differences . 

Therefore, in order to alter or delete a program 
watermark, it is necessary to analyze the program and 
5 find out which method is a dummy method for watermark 
insertion unrelated to the program specifications. 
Since determining whether a part is unrelated to the 
program specifications requires an understanding of the 
program specifications, it is difficult to mechanically 
10 delete a watermark embedded using this method. 

An example of program code generated when Embodiment 
5 is applied is shown in FIG. 14. 

The program indicated by reference numeral 1600a 
in FIG. 14 is the basic source program. The program 
15 resulting from compilation of this program 1600a is the 
program that is input from program input section 201 to 
watermark insertion apparatus 1200. For ease of 
explanation, program 1600b resulting from disassembly 
of compiled program 1600a will be used in the description 
20 here. 

Program 1600c and program 16 OOd are programs in which 
different watermarks and dummy code are inserted. In 
programs 1600a through 1600d, method A2 denotes a dummy 
method, and the numeral before each instruction mnemonic 
25 indicates the line number. 

First, in step 1301, watermark insertion section 
202 generates watermark SI (100111 001101 101000 000000 
000001) andS2 (100111 001101 101000 000000 000010) with 
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6 bits per character from different ID information II 
( (C) 01 ) and 12 ( (C) 02 ) , respectively, for use by watermark 
insertion programs 1600c and 1600d. 

Next, in step 1302, dummy code insertion section 
5 1202 detects a method section in watermark insertion 
program 1600b, and in step 1304 inserts mutually differing 
dummy code in Al, which is not a dummy method (part 
indicated by reference numeral 1601 in FIG. 14). 

Furthermore, when the method is dummy method A2 , 
10 in step 1306 watermark insertion section 202 embeds as 
watermark in watermark insertion program 1600b only the 
number of bits allocated to the instructions subject to 
embedding from watermark information SI and S2. 

In this example, iconst_0 in method A2 of program 
15 1600b is an instruction subject to embedding and 2-bit 
information is allocated thereto, and embedding is 
performed by extracting 2 bits from SI and S2 (part 
indicated by reference numeral 1602 in FIG. 14). 

At this time, watermark insertion section 202 
20 performs extraction from the low-order bits of each 

character , and when extraction is completed for one entire 
character, performs extraction from the low-order bits 
of the next character. 

Dummy code insertion section 1202 also performs the 
25 same kind of dummy code insertion for method A2 as for 
method Al (part indicated by reference numeral 1603 in 
FIG. 14) . 

If the distribution destinations of programs 1600c 
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and 1600d are in collusion, and find differences between 
the programs in order to identify the watermark 
information insertion location, the parts indicated by 
reference numerals 1601 and 1603 , which are not watermark, 
5 will also be detected together with watermark 1602 , making 
it difficult for a watermark insertion location to be 
identified based on collusion attack. 

It is thus possible to prevent mechanical alteration 
or deletion of watermark, and to prevent illegal program 
10 circulation. 

Next, the operation of watermark detection section 
302 according to Embodiment 5 will be described using 
FIG. 15. FIG. 15 is a flowchart showing the operation of 
watermark detection section 302 of Embodiment 5. 
15 First, watermark detection section 302 acquires 

dummy method identification information from watermark 
information storage section 305 (step 1500). 

Then watermark detection section 302 detects a dummy 
method section in which a dummy method is implemented 
20 and a method section in the program using the acquired 
identification information (step 1501), and extracts 
watermark S from the dummy method section using the 
correspondence between bit strings and instruction codes 
stored in watermark information storage section 305 ( step 
25 1502). 

Watermark detection section 302 generates ID 
information uniquely identifying the program 
distribution destination from information stored in ID 
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information storage section 304 and extracted watermark 
S (step 1503), outputs the ID information (step 1504), 
and terminates processing. 

Thus, watermark detection section 302 can easily 
5 detect a dummy method section and method section by using 
identification information, and can identify the program 
distribution destination by extracting watermark S from 
the dummy method section. As a result, illegal program 
circulation can be prevented. 
L0 As described above, according to Embodiment 5, it 

is possible to insert in a program not only watermark 
but also dummy code, comprising an execution code pair, 
that does not affect the specifications. As a result, 
non-watermark code is detected in different places when 
15 collusion attack is performed, making it possible to 
prevent with certainty watermark alteration or deletion 
based on collusion attack. 

(Embodiment 6) 

20 Embodiment 6 alters a program by switching around 

the order of parts other than a watermark insertion 
location, or the code of the entire program. As a result, 
non-watermark code is detected in different places when 
collusion attack is performed, making it possible to 

25 prevent with certainty watermark alteration or deletion 
based on collusion attack. 

Embodiment 6 is described in detail below. The 
difference between the watermark insertion apparatus in 
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Embodiment 6 and watermark insertion apparatus 20 in 
Embodiment 1 lies in the operation of watermark insertion 
section 202 . 

Next, the operation of watermark insertion section 
5 202 of Embodiment 6 will be described using FIG. 16. 
FIG. 16 is a flowchart showing the operation of watermark 
insertion section 202 of Embodiment 6. 

First, watermark insertion section 202 assigns an 
initial value of 1 to variable i (step 1601). Then 
10 watermark insertion section 202 generates, from ID 

information, watermarks ( different for each distribution 
destination) for embedding in the code (program) (step 
1602) . 

Next, watermark insertion section 202 extracts code 
15 parts, within the entire program, that will not affect 
the specifications - that is, that will allow the 
specifications to be maintained — even if their order 
is switched around (step 1603). A code part here means 
a part of a program composed of a plurality of codes. 
20 watermark insertion section 202 then determines 

whether variable i is less than or equal to the number 
(N) of code parts that allow the specifications to be 
maintained even if their order is switched around (step 
1604 ) , and if variable i is less than or equal to N, switches 
25 around the order of the code contained in that code part 
(step 1605), increments i (step 1606), and proceeds to 
step 1604. 

If variable i is not less than or equal to N, watermark 
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insertion section 202 inserts watermark S in the code 
(step 1607) , compiles the source code, stores the 
assembler code line number at which watermark S was input, 
outputs the program, and terminates processing (step 
5 1608). 

In this way, watermark insertion section 202 
converts parts other than a location at which watermark 
is input, while maintaining the specifications, by 
switching around the order of code parts that allow the 
10 specifications to be maintained even if their order is 
switched around. 

Next , program code generated by watermark insertion 
section 202 according to Embodiment 6 will be described 
using FIG. 17 . Program 1700a is an original program input 
15 by program input section 201. Programs 17 00b and 17 00c 
are programs in which different watermark 1702b and 1702c 
for each distribution destination has been input in 
original program 1700a. 

Programs 1700b and 1700c contain code parts 1701b 
20 and 1701c, and 1703band 1703c. Code parts 1701b and 1701c, 
and 1703b and 1703c, are not code parts for insertion 
of a watermark contained in original program 1700a , and 
in these code parts 1701b and 1701c, and 1703b and 1703c, 
the code sequence of code parts 1701a and 1701b that allow 
25 the specifications to be maintained even if their code 
is switched around is changed. 

Thus, program 1700b and program 1700c have been 
converted to different instruction sequences with respect 
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to program 1700a, but the overall specifications have 
not changed. That is to say, in program 1700b and program 
1700c , program 1700a has been converted while maintaining 
its specifications. When the differences between 
5 programs 1700b and 1700c are identified, since program 
code has also been modified at locations other than the 
watermark location, non-watermark code parts 17 0 lb , 1701c, 
1703b, and 1703c are also detected as differences. 

Therefore , in order to alter or delete the watermarks 
10 of programs 1700b and 1700c, it is necessary to analyze 
the programs and find out which parts are watermarks that 
do not affect the program specifications. Since 
determining whether a part does not affect the program 
specifications requires an understanding of the program 
15 specifications, it is difficult to mechanically delete 
a watermark embedded using this method. 

As described above, according to Embodiment 6, 
watermark insertion section 202 operates as a conversion 
means that detects, from among program parts other than 
20 locations at which a program watermark is inserted, 
program parts that allow the specifications to be 
maintained even if the instruction sequence is switched 
around, and performs sequence conversion of program parts 
whose instruction sequence can be switched around without 
25 affecting the program specifications — that is to say, 
while maintaining the specifications. Consequently, 
program parts that do not affect program specifications, 
comprising non-watermark code, are detected by collusion 
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attack. As a result, it is possible to prevent watermark 
alteration or deletion with certainty, and to prevent 
illegal program circulation. 

Also, according to Embodiment 6, with regard to 
5 sequence conversion of program parts for which switching 
around of the instruction sequence presents no problem, 
permutations of instruction statements within a program 
part are found, and conversion is performed in accordance 
with a permutation selected so as to be different for 
10 each distribution destination. As a result, the 
instruction sequences of program parts for which 
switching around of the instruction sequence presents 
no problem are different for each distribution 
destination. It is thus difficult to identify a program 
15 part for which switching around of the instruction 

sequence presents no problem, and it is possible to prevent 
watermark alteration or deletion with certainty. 

As a method other than that of conversion in 
accordance with instruction sequence permutations, the 
20 order of program parts for which switching around of the 
instruction sequence presents no problem may be made 
different for each distribution destination by being 
converted randomly. 

It is also possible to hold historical information 
25 on sequence conversion of code contained in code parts 
for which sequence switching presents no problem, and 
to use this historical information to perform conversion 
of code parts for which sequence switching presents no 
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problem so as to be different for each distribution 
destination . 

By this means , sequence conversion of code contained 
in code parts for which sequence switching presents no 

5 problem can be made different for each distribution 
destination reliably and easily. 

This application is based on Japanese Patent 
Application No. 2002-311815 filed on October 25, 2002, 
Japanese Patent Application No . 2003-133566 filed on May 

10 12, 2003, and Japanese Patent Application No .2003-324805 
filed on September 17, 2003, entire contents of which 
are expressly incorporated by reference herein. 

Industrial Applicability 

15 as described above, according to the present 

invention it is possible to insert a watermark so that 
it is difficult to identify the watermark insertion 
location, and therefore the present invention is 
applicable over a wide range including the circulation 

20 of computer programs using a network. 
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CLAIMS 

1. A watermark insertion apparatus comprising: 

a watermark insertion section that inserts in a 
5 program watermark that differs for each program 
distribution destination; and 

a code insertion section that inserts in said program 
watermark verification code that prevents said program 
from operating correctly when said watermark is tampered 
10 with; 

wherein said watermark verification code is made 
identical regardless of said distribution destination. 

2. The watermark insertion apparatus according to 
15 claim 1, wherein said watermark is generated from ID 
information that uniquely determines a program 
distribution destination . 

3* The watermark insertion apparatus according to 
20 claim 1/ further comprising a function insertion section 
that defines a function that outputs a predetermined 
constant from said watermark and inserts an expression 
that assigns said function to a variable in said program; 
wherein 

25 said watermark verification code is a conditional 

branch that determines whether said variable and said 
constant are equal , and when said variable and said 
constant are not equal halts said program; and 
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said watermark verification code is made identical 
regardless of said distribution destination. 

4. The watermark insertion apparatus according to 
claim 1/ wherein said watermark verification code is 
necessary for said program to be made to operate correctly . 

5. The watermark insertion apparatus according to 
claim 4, wherein said watermark verification code has 
inserted a calculation expression that does not affect 
a decision statement of a decision branch generated from 
said watermark in said decision branch extracted from 
said program. 

6. A watermark extraction apparatus comprising: 

a program input section that inputs a program in 
which the watermark insertion apparatus according to 
claim 1 has inserted said watermark and said watermark 
verification code; and 
0 a watermark detection section that extracts said 

watermark from said program and generates ID information 
that uniquely identifies said distribution destination 
based on said watermark; 

wherein a distribution destination is identified 
5 based on generated said ID information. 

7. A program illegal distribution prevention system 
comprising : 
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the watermark insertion apparatus according to 
claim 1; 

a program input section that inputs a program in 
which the watermark insertion apparatus according to 
5 claim 1 has inserted said watermark and said watermark 
verification code; and 

a watermark detection section that extracts said 
watermark from said program and generates ID information 
that uniquely identifies said distribution destination 
10 based on said watermark; 

wherein a distribution destination is identified 
based on generated said ID information. 

8 . The program illegal distribution prevention system 
15 according to claim 7 , wherein said watermark insertion 
apparatus is provided at said distribution destination. 

9. A watermark insertion method wherein: 

watermark that differs for each program 
20 distribution destination is inserted in said program and 
said watermark is used; 

said program is prevented from operating correctly 
when said watermark is tampered with; and 

watermark verification code that is identical 
25 regardless of said distribution destination is inserted 
in said program. 



10. A watermark insertion method wherein: 
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watermark that differs for each program 
distribution destination is inserted in a program; and 

a periphery of an insertion location of said 
watermark or entire said program is converted while 
5 maintaining specifications. 

11 . A watermark insertion program that causes a computer 
to : 

insert watermark that differs for each program 
10 distribution destination in said program and use said 
watermark; 

prevent said program for distribution from 
operating correctly when said watermark is tampered with ; 
and 

15 insert watermark verification code that is 

identical regardless of said distribution destination 
in said program for distribution. 

12. A watermark insertion apparatus comprising: 

20 a watermark insertion section that inserts in a 

program watermark that differs for each program 
distribution destination; and 

a conversion section that converts a part other than 
a location at which said watermark is inserted while 

25 maintaining specifications of said program. 

13. The watermark insertion apparatus according to 
claim 12 f wherein said conversion section inserts an 
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execution code pair that does not affect specifications 
in a part other than a location at which said watermark 
is inserted. 

5 14. The watermark insertion apparatus according to 
claim 12, wherein identification information is stored 
that indicates an insertion location of said watermark. 

15. The watermark insertion apparatus according to 
10 claim 14 , wherein said identification information is a 

method name or line number. 

16. The watermark insertion apparatus according to 
claim 12/ wherein said conversion section performs 

15 obfuscating so that specifications are not affected in 
a part other than a location at which said watermark is 
inserted. 

17. A watermark extraction apparatus comprising: 

20 a program input section that inputs a program in 

which the watermark insertion apparatus according to 
claim 12 has inserted said watermark; and 

a watermark detection section that extracts said 
watermark from said program; 

25 wherein a distribution destination is identified 

based on extracted said watermark. 



18. A watermark extraction apparatus comprising: 
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a program input, section that inputs a program in 
which the watermark insertion apparatus according to 
claim 15 has inserted said watermark; and 

a watermark detection section that obtains said 
identification information, identifies a watermark 
insertion location from said identification information, 
and extracts said watermark from only identified said 
watermark insertion location; 

wherein a distribution destination is identified 
based on extracted said watermark. 

19. A program that causes a computer to: 
insert in a program watermark that differs for each 

program distribution destination; and 
15 convert a part other than a location at which said 

watermark is inserted without changing specifications 
of said program. 

20. The watermark insertion apparatus according to 
20 claim 12/ wherein said conversion section converts a 

sequence of a part that is a part other than a location 
at which said watermark is inserted and is a part that 
does not affect specifications even if said sequence is 
switched around. 

25 

21. The watermark insertion apparatus according to 
claim 20 , wherein historical information on a part that 
does not affect said specifications is held, and using 



5 



10 
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said historical information/ conversion of a part that 
does not affect said specifications is made to differ 
for each distribution destination. 
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800a 

gcd(int x,int y){ 
int a=x,b=y,c; 
while(b!=0){ 
a=a % b; 
c=a; a=b; b=c; 
if( a<0)a=-a; 



int vall=1234,val2=5678; -^.701 

gcd(int x,int y){ 
int a=x, b=y, c; 

int val3=vall+0.195667*val2; ^ 

int val4=3.700972*vall+0.195667*val2; >^ 702 

int val5=5.601297*vall+0.195667*val2; J 

while(b!=0){ 

a=a % b; 

c=a;a=b;b=c; 

if(a<va!3+val4+val5)a=-a; -\-703 



} 

return a; 



800b 



if(val3!=2345)a++; 
if(val4!=5678)assert(0); 

} 




return a; 
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